For students and early-career IT professionals, cloud computing can feel deceptively simple at first. You create a virtual machine, assign an IP address, connect a storage account, and it appears that the cloud is simply someone else’s data center with a web interface.
That interpretation works for about five minutes.
Once you begin working with real cloud environments, you quickly encounter subscriptions, resource groups, identity systems, virtual networks, availability zones, consumption-based pricing, governance policies, role-based access control, monitoring, and dozens of services that do not have a direct equivalent in a traditional server room.
This is the problem that Microsoft Azure Fundamentals (AZ-900) is designed to address.
AZ-900 is Microsoft’s entry-level Azure certification exam. It is not an administrator exam, a network engineering exam, or an architecture exam. Instead, it tests whether you understand the language, structure, services, management model, and basic design concepts behind Microsoft Azure.
For someone entering cloud computing from networking, system administration, software development, or university-level IT study, that foundation is more useful than it might initially appear.
Exam blueprint note: This article is based on the Microsoft AZ-900 skills measured as of July 20, 2026. Microsoft updates certification exams periodically, so candidates should always verify the latest study guide before scheduling the exam.
What Is Microsoft Azure Fundamentals?
Microsoft Azure Fundamentals is a beginner-level Microsoft certification focused on general cloud concepts and the core technologies used within Azure.
The certification is earned by passing Exam AZ-900: Microsoft Azure Fundamentals.
Microsoft positions the certification as a common starting point for people beginning an Azure career. Candidates are expected to understand cloud concepts, Azure architectural components, compute, networking, storage, identity, security, governance, management, and monitoring at a foundational level.
| Item | AZ-900 Details |
|---|---|
| Certification | Microsoft Certified: Azure Fundamentals |
| Exam | AZ-900: Microsoft Azure Fundamentals |
| Level | Beginner |
| Primary Product | Microsoft Azure |
| Passing Score | 700 or higher |
| Assessment Time | 45 minutes |
| Certification Renewal | Fundamentals certifications currently do not expire |
| Recommended Background | Basic familiarity with IT concepts is useful |
Exam pricing depends on the country or region where the exam is proctored, so it is better to check the current Microsoft certification page rather than relying on an old price quoted in a blog post.
Who Should Take AZ-900?
AZ-900 is particularly suitable for several groups.
- Students studying networking, computer science, information systems, or cybersecurity
- Junior network engineers who are beginning to work with cloud networking
- System administrators moving from on-premises infrastructure to Azure
- Help desk and technical support professionals who want a broader understanding of cloud services
- Developers who need to understand the Azure platform around their applications
- IT professionals preparing for more advanced Microsoft certifications
- Technical sales, presales, and project staff who need to communicate about Azure accurately
You do not need years of Azure administration experience before attempting AZ-900. In fact, the exam exists specifically to establish the vocabulary and mental model that you will need before moving deeper into Azure.
If you are currently planning your study path, a structured AZ-900 certification preparation resource can also help you organize the topics around the official Microsoft exam objectives.
Is the AZ-900 Certification Worth It?
The answer depends on what you expect the certification to do.
If you expect AZ-900 by itself to prove that you can build and operate a production Azure environment, it will disappoint you. The exam does not demonstrate the same level of implementation skill as an administrator, networking, security, or architecture certification.
But that does not make it unimportant.
Its real value is that it forces beginners to organize Azure into a coherent technical model.
After studying properly for AZ-900, terms such as subscription, resource group, availability zone, virtual network, RBAC, Azure Policy, Microsoft Entra ID, Azure Monitor, and ExpressRoute should no longer sound like unrelated product names.
You begin to understand how those components relate to one another.
For students
AZ-900 provides a recognizable credential that can complement academic study. More importantly, it introduces technologies that students may not encounter in traditional networking or operating system courses.
For network engineers
The certification provides an important transition from physical network thinking to cloud network thinking.
Traditional networking teaches you about routers, switches, VLANs, firewalls, subnets, routing tables, and WAN connectivity. Azure does not remove those concepts, but it changes where and how they are implemented.
You now need to think about virtual networks, cloud routing, private endpoints, virtual network peering, VPN gateways, ExpressRoute, identity, resource hierarchy, and policy-driven management.
For career development
AZ-900 works best as a foundation rather than a final destination. It can make more advanced Azure training significantly easier because you already understand the platform terminology before encountering implementation details.
What Does the AZ-900 Exam Cover in 2026?
The current AZ-900 exam is divided into three major skill domains.
| Exam Domain | Weight |
|---|---|
| Describe cloud concepts | 25–30% |
| Describe Azure architecture and services | 35–40% |
| Describe Azure management and governance | 30–35% |
Notice the verbs Microsoft uses: describe, compare, and identify.
That tells you something important about the expected technical depth.
AZ-900 is primarily testing whether you understand what a technology is, why it exists, how it differs from another service, and when it is appropriate. It is not primarily testing whether you can configure every service from the command line.
Domain 1: Cloud Concepts — 25–30%
The first domain establishes the basic ideas behind cloud computing.
Do not underestimate this section simply because it sounds theoretical. Many later Azure concepts make little sense until you understand why cloud infrastructure is designed differently from traditional infrastructure.
Public, Private, and Hybrid Cloud
You should understand the differences between the three major cloud deployment models.
A public cloud uses infrastructure operated by a cloud provider and delivered to customers as services.
A private cloud provides cloud-style infrastructure dedicated to a particular organization.
A hybrid cloud combines environments, commonly connecting an organization’s existing infrastructure with public cloud resources.
For the exam, memorizing definitions is not enough. You should be able to recognize which model fits a business scenario.
The Shared Responsibility Model
One of the most important ideas in cloud security is that moving to the cloud does not transfer every security responsibility to Microsoft.
Responsibility changes depending on the service model.
With Infrastructure as a Service, customers retain significant responsibility for operating systems, applications, identities, data, and configuration. As you move toward Platform as a Service and Software as a Service, the cloud provider manages more of the underlying infrastructure.
A good way to study this concept is to ask:
“Who is responsible for this layer?”
IaaS, PaaS, and SaaS
You need to understand the three classic cloud service models.
- IaaS — Infrastructure as a Service: provides infrastructure resources such as virtual machines, storage, and networking while leaving more management responsibility to the customer.
- PaaS — Platform as a Service: provides a managed platform for applications without requiring customers to manage as much of the underlying operating system and infrastructure.
- SaaS — Software as a Service: delivers a completed application to users.
The important exam skill is not reciting what the letters mean. You should be able to compare operational responsibility and choose the appropriate model for a scenario.
Cloud Economics
Azure follows a consumption-oriented model for many services. Instead of purchasing all infrastructure capacity before you need it, cloud resources can often be provisioned and billed according to usage.
This introduces several important concepts:
- Consumption-based pricing
- Scalability
- Elasticity
- High availability
- Reliability
- Predictability
- Manageability
A common beginner mistake is assuming that cloud automatically means cheap. It does not.
Cloud makes infrastructure more flexible, but poorly designed or poorly governed cloud environments can still generate significant cost.
Domain 2: Azure Architecture and Services — 35–40%
This is currently the largest AZ-900 domain and, for technical learners, usually the most interesting.
Azure Regions and Availability Zones
Azure is built from physical infrastructure distributed around the world.
You should understand the relationship between:
- Azure datacenters
- Azure regions
- Region pairs
- Sovereign regions
- Availability zones
An availability zone is not simply another name for a region. Zones provide physically separate locations within supported Azure regions and are used as part of highly available designs.
For exam questions, pay attention to whether a scenario is trying to protect against failure of an individual infrastructure location or a broader regional event.
Azure Resource Hierarchy
One of the most useful Azure concepts for beginners is understanding how resources are organized.
At a simplified level:
Management Groups → Subscriptions → Resource Groups → Resources
A resource might be a virtual machine, storage account, virtual network, public IP address, or another Azure service.
Resource groups provide a logical management boundary for related resources.
Subscriptions provide billing and management boundaries, while management groups allow organizations to apply governance across multiple subscriptions.
Understanding this hierarchy is essential because Azure administration is not just about individual servers. It is about controlling collections of resources through centralized management structures.
Azure Compute Services
Azure provides several ways to run workloads.
Azure Virtual Machines
Virtual machines provide relatively high control over the operating system and software environment. They are conceptually familiar to anyone who has worked with VMware, Hyper-V, or traditional server virtualization.
But running a VM in Azure still means thinking about surrounding resources such as:
- Virtual networks
- Subnets
- Network interfaces
- IP addresses
- Storage
- Identity
- Availability
- Monitoring
Virtual Machine Scale Sets
Azure Virtual Machine Scale Sets are designed to manage groups of virtual machines and support scalable architectures.
For AZ-900, focus on the reason such a service exists rather than memorizing configuration parameters.
Containers
Containers package applications and their dependencies while sharing more of the underlying operating system environment than traditional virtual machines.
You should understand the conceptual difference between a container and a VM.
Azure Functions and Serverless Computing
Azure Functions is associated with serverless computing.
“Serverless” does not mean that servers have disappeared. It means developers can focus more heavily on application logic while the cloud platform handles much of the underlying infrastructure management and scaling.
Azure Networking: The Part Network Students Should Pay Attention To
If your background is networking, this is where AZ-900 begins to connect directly with concepts you already know.
Azure Virtual Network
An Azure Virtual Network (VNet) is one of the fundamental building blocks of Azure networking.
A VNet provides a logically isolated network environment in Azure where resources can communicate.
Like traditional IP networks, VNets can contain multiple subnets.
The important shift is that the network is now software-defined and integrated directly into the Azure control plane.
Subnets
Subnets divide a VNet address space into smaller network segments.
If you already understand CIDR notation and subnetting, the underlying IP concepts will feel familiar. The difference is that network configuration is managed as a cloud resource rather than only through physical switches and routers.
Virtual Network Peering
Virtual network peering allows VNets to communicate using the Microsoft backbone network.
For AZ-900, understand the purpose of peering and how it differs conceptually from connecting networks through a traditional VPN.
Azure VPN Gateway
Azure VPN Gateway can provide encrypted connectivity between Azure virtual networks and external networks, including on-premises environments.
This is one of the technologies used when building hybrid cloud environments.
Azure ExpressRoute
ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through a connectivity provider rather than relying on a normal public Internet path for that connection.
For beginners, a useful comparison is:
- VPN Gateway: encrypted connectivity commonly transported over the Internet
- ExpressRoute: private connectivity through an ExpressRoute connectivity model
You do not need carrier-level ExpressRoute design knowledge for AZ-900, but you should understand why an enterprise might choose it.
Azure DNS
Azure DNS provides DNS hosting capabilities using Azure infrastructure.
Network students should already understand what DNS does. AZ-900 mainly requires understanding where Azure DNS fits into the Azure service portfolio.
Public and Private Endpoints
This area is especially important because cloud services do not always behave like traditional servers sitting on a LAN.
A public endpoint allows access through a publicly reachable endpoint, subject to the relevant security configuration.
Private endpoint technology allows supported Azure services to be accessed through private IP addressing within a virtual network.
Understanding this difference is the beginning of understanding modern cloud network security.
These networking topics are also worth reviewing carefully during your AZ-900 exam preparation, because Microsoft often tests whether you can distinguish between services that solve similar but not identical connectivity requirements.
Azure Storage Services
Storage questions are another major part of the Azure architecture section.
You should be able to distinguish Azure storage options and understand why different workloads require different storage models.
Important areas include:
- Azure Blob Storage
- Azure Files
- Storage account concepts
- Storage access tiers
- Storage redundancy options
- File migration and synchronization tools
The exam blueprint also includes technologies such as:
- AzCopy
- Azure Storage Explorer
- Azure File Sync
- Azure Migrate
- Azure Data Box
Again, think in terms of use cases. A file synchronization tool solves a different problem from a physical data transfer appliance.
Identity, Access, and Security
Modern cloud environments depend heavily on identity.
For AZ-900, you should understand Microsoft Entra ID, which provides identity and access capabilities for Microsoft cloud environments.
Authentication Technologies
The exam includes concepts such as:
- Single sign-on (SSO)
- Multifactor authentication (MFA)
- Passwordless authentication
- External identities
- Conditional Access
Azure Role-Based Access Control
Azure RBAC controls what authenticated identities are authorized to do with Azure resources.
A simple way to separate the concepts is:
Authentication asks: “Who are you?”
Authorization asks: “What are you allowed to do?”
This distinction appears repeatedly in real-world cloud security.
Zero Trust
The exam also expects candidates to understand the concept of Zero Trust.
Rather than assuming that something is automatically trustworthy because it is inside a traditional network boundary, Zero Trust emphasizes explicit verification, limited access, and continuous consideration of security context.
Defense in Depth
Defense in depth means security should not depend on a single control.
Identity controls, network controls, endpoint protection, data protection, monitoring, and governance all contribute to the overall security posture.
Microsoft Defender for Cloud
You should also understand the purpose of Microsoft Defender for Cloud as part of Azure security posture and workload protection capabilities.
Domain 3: Azure Management and Governance — 30–35%
This section is sometimes overlooked by students who prefer networking or compute.
That is a mistake.
Cloud platforms become useful at scale because organizations can govern large numbers of resources consistently.
Azure Cost Management
AZ-900 expects candidates to understand factors that influence Azure cost and the purpose of tools used to estimate and manage spending.
Important concepts include:
- Azure Pricing Calculator
- Azure Cost Management capabilities
- Resource usage
- Service selection
- Region and configuration choices
- Tags
Tags are metadata that can be attached to Azure resources and can help organizations categorize resources for management, reporting, ownership, and cost analysis.
Azure Policy, Resource Locks, and Microsoft Purview
Azure Policy
Azure Policy helps organizations evaluate and enforce standards across Azure resources.
Think of it as governance at scale.
If an organization requires resources to follow particular configuration rules, Azure Policy can help enforce or audit those requirements.
Resource Locks
Resource locks help protect important Azure resources from accidental modification or deletion.
A lock is not the same thing as RBAC.
RBAC is primarily about authorization. Resource locks add protection against certain management actions even when users otherwise have permissions.
Microsoft Purview
Microsoft Purview appears in the current AZ-900 governance objectives. At the Fundamentals level, focus on understanding its purpose in data governance, security, risk, and compliance scenarios rather than trying to learn every Purview feature.
Managing and Deploying Azure Resources
Azure resources can be managed in several ways.
AZ-900 candidates should recognize:
- Azure portal
- Azure Cloud Shell
- Azure CLI
- Azure PowerShell
- Azure Resource Manager
- ARM templates
- Infrastructure as Code
- Azure Arc
Infrastructure as Code
Infrastructure as Code, usually abbreviated as IaC, means infrastructure can be described and deployed through machine-readable configuration rather than relying only on manual portal operations.
This is an important cloud operations concept even if AZ-900 does not require you to become an ARM template expert.
Manual configuration works for learning. Repeatable automation becomes much more important as environments grow.
Azure Arc
Azure Arc extends Azure management capabilities to resources outside a traditional Azure-only environment, including supported on-premises and multicloud scenarios.
For AZ-900, concentrate on the management concept rather than detailed Arc architecture.
Monitoring: Advisor vs Service Health vs Azure Monitor
This is an area where exam questions can become confusing because several Azure services appear to do similar things.
They do not.
| Service | Think of It As |
|---|---|
| Azure Advisor | Recommendations for improving Azure environments |
| Azure Service Health | Information about Azure service issues and events relevant to you |
| Azure Monitor | Monitoring and observability platform for resources and applications |
| Log Analytics | Querying and analyzing collected log data |
| Azure Monitor Alerts | Notifications or actions based on monitoring conditions |
| Application Insights | Application performance and telemetry monitoring |
Instead of memorizing product descriptions word for word, imagine a scenario and ask which service would solve the problem.
How Difficult Is AZ-900?
AZ-900 is a beginner-level exam, but “beginner” does not mean “no preparation required.”
Someone with several years of infrastructure or cloud experience may find much of the material straightforward. A student encountering enterprise cloud concepts for the first time may need substantially more study.
The difficulty is usually not deep configuration.
The difficulty comes from learning a large number of services and understanding the difference between technologies that initially sound similar.
For example:
- Availability Zone vs Availability Set
- Microsoft Entra ID vs Azure RBAC
- Azure Policy vs RBAC vs Resource Locks
- VPN Gateway vs ExpressRoute
- Public Endpoint vs Private Endpoint
- Azure Advisor vs Service Health vs Azure Monitor
- IaaS vs PaaS vs SaaS
If you can explain those differences without looking at your notes, you are studying in the right way.
A Practical 14-Day AZ-900 Study Plan
There is no single perfect preparation schedule, but beginners can use the following structure as a starting point.
Days 1–2: Cloud Fundamentals
- Learn public, private, and hybrid cloud models
- Understand the shared responsibility model
- Compare IaaS, PaaS, and SaaS
- Understand scalability, elasticity, availability, and consumption-based pricing
Days 3–5: Azure Architecture
- Study regions and availability zones
- Understand subscriptions and resource groups
- Learn management groups
- Draw the Azure resource hierarchy from memory
Days 6–7: Compute and Networking
- Compare virtual machines, containers, and Functions
- Study Azure Virtual Network and subnets
- Understand VNet peering
- Compare VPN Gateway and ExpressRoute
- Understand public and private endpoints
Day 8: Azure Storage
- Compare major storage services
- Understand storage tiers
- Review redundancy concepts
- Understand AzCopy, Storage Explorer, File Sync, Azure Migrate, and Data Box
Day 9: Identity and Security
- Study Microsoft Entra ID
- Understand authentication vs authorization
- Review MFA, SSO, passwordless, and Conditional Access
- Learn RBAC, Zero Trust, and defense in depth
Days 10–11: Governance and Cost
- Use the Azure Pricing Calculator
- Understand Azure Cost Management
- Study Azure Policy
- Understand resource locks
- Review Microsoft Purview
Day 12: Management and Monitoring
- Compare portal, CLI, PowerShell, and Cloud Shell
- Understand ARM and Infrastructure as Code
- Review Azure Arc
- Compare Advisor, Service Health, Azure Monitor, Log Analytics, and Application Insights
Day 13: Hands-On Review
Even though AZ-900 is a fundamentals exam, spend some time inside Azure.
At minimum, try to:
- Open the Azure portal
- Create a resource group
- Explore available regions
- Open the Virtual Network creation interface
- Examine VNet and subnet configuration
- Explore Microsoft Entra ID
- Open Azure Monitor
- Try the Azure Pricing Calculator
The objective is not to become an Azure administrator in one afternoon. The objective is to connect the terminology in the documentation with an actual interface.
Day 14: Practice Assessment and Weak Areas
Take Microsoft’s official practice assessment and review every topic you cannot explain confidently.
Do not simply memorize the correct answer.
For every incorrect question, ask why the other choices were wrong.
That approach creates much stronger understanding than memorizing a question bank.
At this stage, combining the official Microsoft material with an organized AZ-900 study resource can make it easier to identify weak topics before exam day.
Common AZ-900 Study Mistakes
1. Memorizing service names without understanding scenarios
Microsoft exams frequently test whether you can select the appropriate service for a requirement.
Knowing the definition of ExpressRoute is useful. Knowing why a business might choose ExpressRoute instead of an Internet-based VPN is much more useful.
2. Ignoring governance
Technical students often spend most of their time studying virtual machines and networking while giving very little attention to Azure Policy, cost management, resource locks, and monitoring.
The current exam weighting makes that a poor strategy.
3. Treating every Microsoft service as equally important
Azure contains hundreds of services. AZ-900 does not require you to learn all of them.
Use the official study guide as your boundary.
4. Studying only from exam dumps
Question dumps may encourage recognition rather than understanding and can quickly become outdated when Microsoft changes the exam.
A better approach is to use the official skills outline as a checklist and the Microsoft Learn material as your primary reference.
5. Never opening the Azure portal
It is possible to study AZ-900 entirely from documentation, but even a small amount of hands-on exposure makes the architecture easier to remember.
Exam-Day Strategy
Because AZ-900 focuses on foundational knowledge, careful reading matters.
- Identify exactly what the scenario is asking for.
- Look for words such as private, public, managed, highly available, identity, governance, recommendation, monitoring, or cost.
- Eliminate answers that solve a different technical problem.
- Do not assume that the most advanced Azure service is automatically the correct answer.
- When two answers look similar, think about the responsibility model and the exact scope of each service.
Microsoft also provides an exam sandbox that lets candidates become familiar with the exam interface before the real test.
What Should You Study After AZ-900?
The best next step depends on the technical direction you want to pursue.
If your goal is Azure administration, continue toward administrator-level skills involving compute, networking, identity, governance, storage, and operations.
If your background is networking, go deeper into:
- Azure Virtual Network architecture
- IP addressing and subnet design
- Network Security Groups
- User-defined routes
- Azure Firewall
- VPN Gateway
- ExpressRoute
- Azure Load Balancer
- Application Gateway
- Private Link and private endpoints
- Azure DNS
- Hybrid networking
- Hub-and-spoke architecture
At that point, Azure stops looking like a collection of cloud products and starts looking like an actual infrastructure platform.
Final Thoughts
AZ-900 is easy to underestimate.
It is certainly an entry-level certification, and it will not turn someone into a cloud engineer after a few days of study.
But a good foundation has value.
The exam introduces several ideas that appear repeatedly throughout modern cloud infrastructure: shared responsibility, software-defined networking, identity-centered security, Infrastructure as Code, resource governance, consumption-based economics, monitoring, and globally distributed infrastructure.
For students and junior networking professionals, the most useful goal is therefore not simply to pass AZ-900.
Use the exam as a structured reason to understand how Azure works.
If you finish your preparation able to explain why a company would choose a VNet, private endpoint, availability zone, RBAC role, Azure Policy, VPN Gateway, ExpressRoute, or Azure Monitor component in a particular scenario, then the certification has already done something valuable.
For candidates who want to continue reviewing the certification objectives in a more structured format, you can also visit our AZ-900 Microsoft Azure Fundamentals course page.
Frequently Asked Questions About AZ-900
Is AZ-900 suitable for complete beginners?
Yes. It is a Fundamentals-level Microsoft certification. Basic familiarity with networking, operating systems, development, databases, or general IT concepts will make the material easier, but advanced Azure experience is not expected.
Do I need programming knowledge for AZ-900?
Programming is not the focus of AZ-900. You should understand concepts such as automation, Infrastructure as Code, serverless computing, Azure CLI, and PowerShell at a foundational level, but this is not a programming certification.
Is AZ-900 useful for network engineers?
Yes, especially for network engineers moving toward cloud infrastructure. The exam introduces Azure VNets, subnets, peering, Azure DNS, VPN Gateway, ExpressRoute, public and private endpoints, identity, governance, and hybrid cloud concepts.
Does the Microsoft Azure Fundamentals certification expire?
Under Microsoft’s current certification policy, Fundamentals certifications do not expire and therefore do not require the annual renewal process used for many Associate, Expert, and Specialty certifications.
Is AZ-900 enough to become an Azure engineer?
No. AZ-900 validates foundational knowledge. Professional Azure engineering requires hands-on skills involving deployment, troubleshooting, security, networking, automation, monitoring, architecture, and operational processes.
Should I use practice exams?
Yes, but use them to identify knowledge gaps rather than memorize questions. Microsoft’s official practice assessment is a useful starting point because it is aligned with the current certification objectives.
Candidates preparing for the exam can also review our Microsoft Azure Fundamentals AZ-900 preparation page alongside the official Microsoft documentation.
Official and Recommended AZ-900 Resources
- Microsoft Certified: Azure Fundamentals
Microsoft Azure Fundamentals Certification Page
- Official AZ-900 Study Guide
Study Guide for Exam AZ-900: Microsoft Azure Fundamentals
- Microsoft Learn Azure Fundamentals Training
Introduction to Cloud Infrastructure: Describe Cloud Concepts
- Official AZ-900 Practice Assessment
Microsoft AZ-900 Practice Assessment
- Azure Architecture Center
Microsoft Azure Architecture Center
- Azure Networking Architecture Guidance
Get Started with Azure Networking Architecture Design
- Microsoft Certification Expiration Policy
Microsoft Credential Expiration Policies
Additional AZ-900 Study Resource
For additional exam preparation material, topic review, and a structured overview of the certification, visit our
AZ-900 Microsoft Azure Fundamentals certification resource.
Editorial note: Microsoft periodically updates certification objectives, terminology, exam delivery details, and Azure services. Always compare your study material against the latest Microsoft Learn AZ-900 study guide before scheduling the exam.
